Examkin

Soru

Zorluk: ZorAzure Monitor Metrics and Diagnostic Settings

You have an Azure subscription that contains an Azure Virtual Network Gateway named `VNetGW1` and an Azure Storage account named `storeaudit1`.

You need to configure diagnostic logging for `VNetGW1` to meet the following requirements:
1. Stream VPN tunnel connectivity logs (`TunnelDiagnosticLog`) to an Azure Event Hub to be consumed by a third-party security information and event management (SIEM) tool.
2. Archive gateway routing logs (`RouteDiagnosticLog`) to `storeaudit1` for long-term audit compliance.
3. Minimize ingestion and storage costs by ensuring that no log data is sent to a destination where it is not required.

Which configuration should you implement to meet the requirements?

  1. Create two diagnostic settings: one that sends TunnelDiagnosticLog to the Event Hub, and another that sends RouteDiagnosticLog to storeaudit1.Cevap
  2. B
    Create a single diagnostic setting that sends both TunnelDiagnosticLog and RouteDiagnosticLog to both the Event Hub and storeaudit1.
  3. C
    Create a single diagnostic setting that sends TunnelDiagnosticLog to the Event Hub, and configure an Azure Storage Lifecycle Management policy on storeaudit1 to import the RouteDiagnosticLog from the gateway.
  4. D
    Create a single diagnostic setting that sends both TunnelDiagnosticLog and RouteDiagnosticLog to storeaudit1, and assign the Storage Blob Data Reader role to the Event Hub.

Cevap

Create two separate diagnostic settings: one to send TunnelDiagnosticLog to the Event Hub, and a second to send RouteDiagnosticLog to the storage account.
The correct configuration is to create two separate diagnostic settings. In Azure Monitor, diagnostic settings apply all selected log categories to all configured destinations. If a single diagnostic setting were used to target both the Event Hub and the storage account while selecting both log categories, both types of logs would be duplicated across both destinations. To avoid data duplication and minimize costs, each log category must be routed to its respective destination via its own dedicated diagnostic setting.

Adım Adım Çözüm

1
Analyze the destination and category requirements.
TunnelDiagnosticLog must be sent to the Event Hub, and RouteDiagnosticLog must be sent to the storage account.
This separation is necessary to satisfy the distinct targets required for the SIEM integration and archiving compliance.
2
Determine the limitation of a single diagnostic setting.
A single diagnostic setting routes all enabled log categories to all configured destinations.
Understanding this default routing behavior is critical to evaluating how data is distributed across the destinations.
3
Evaluate the impact of combining destinations in a single setting on the cost requirement.
Combining them would duplicate both log categories across both destinations, violating the requirement to minimize cost and avoid sending unnecessary data.
This step validates that a single setting cannot satisfy the cost-minimization constraint.
4
Determine the correct multi-setting configuration.
Two distinct diagnostic settings must be created, each selecting a single category and routing it to its respective destination.
Creating separate settings prevents cross-duplication of logs, ensuring cost efficiency.

Anahtar Kavram

Diagnostic settings routing behavior and multi-destination configuration
Bu soruyu puanla

Konular

Azure Monitor Metrics and Diagnostic Settings

Bu konudan daha fazla soru